{"record":{"id":"5f03d4815d2b7e27","repo":"n8n-io/n8n","slug":"hardcoded-credentials","errorCode":"HARDCODED_CREDENTIALS","errorMessage":"'${node.name}' has a hardcoded value for sensitive header \"${header.name}\". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential).","messagePattern":"'(.+?)' has a hardcoded value for sensitive header \"(.+?)\"\\. Should create credentials, setting genericAuthType to httpTemplatedCustomAuth \\(or reuse an existing httpHeaderAuth/httpBearerAuth credential\\)\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/@n8n/workflow-sdk/src/workflow-builder/plugins/validators/http-request-validator.ts","lineNumber":91,"sourceCode":"\t\t}\n\n\t\t// Check header parameters for sensitive headers\n\t\tconst headerParams = params.headerParameters as\n\t\t\t| { parameters?: Array<{ name?: string; value?: unknown }> }\n\t\t\t| undefined;\n\n\t\tif (headerParams?.parameters) {\n\t\t\tfor (const header of headerParams.parameters) {\n\t\t\t\tconst headerValueStr =\n\t\t\t\t\ttypeof header.value === 'string' ? header.value : JSON.stringify(header.value);\n\t\t\t\tif (\n\t\t\t\t\theader.name &&\n\t\t\t\t\tisSensitiveHeader(header.name) &&\n\t\t\t\t\theader.value &&\n\t\t\t\t\t!containsExpression(headerValueStr)\n\t\t\t\t) {\n\t\t\t\t\tissues.push({\n\t\t\t\t\t\tcode: 'HARDCODED_CREDENTIALS',\n\t\t\t\t\t\tmessage: `'${node.name}' has a hardcoded value for sensitive header \"${header.name}\". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential).`,\n\t\t\t\t\t\tseverity: 'warning',\n\t\t\t\t\t\tnodeName: node.name,\n\t\t\t\t\t\tparameterPath: `headerParameters.parameters[${header.name}]`,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// New plain generic credentials are steered to Templated Custom Auth: a\n\t\t// provider documenting `Authorization: Bearer <token>` reliably lures the\n\t\t// model into httpBearerAuth, and setup rejects that for new credentials.\n\t\tconst genericAuthType = params.genericAuthType;\n\t\tif (\n\t\t\tparams.authentication === 'genericCredentialType' &&\n\t\t\ttypeof genericAuthType === 'string' &&\n\t\t\tTEMPLATABLE_PLAIN_AUTH_TYPES.has(genericAuthType)\n\t\t) {","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/workflow-sdk/src/workflow-builder/plugins/validators/http-request-validator.ts#L73-L109","documentation":"Error \"'${node.name}' has a hardcoded value for sensitive header \"${header.name}\". Should create credentials, setting genericAuthType to httpTemplatedCustomAuth (or reuse an existing httpHeaderAuth/httpBearerAuth credential).\" thrown in n8n-io/n8n.","triggerScenarios":"Thrown at packages/@n8n/workflow-sdk/src/workflow-builder/plugins/validators/http-request-validator.ts:91 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}